Create multiple tunnels between a VNet and an on-premises site with automatic failover

Question

We are currently using a site-to-site VPN connection between Azure and my on-premiese VPN. We want to create one more site-to-site VPN connection between them, how can between tunnels have automatic failover when a tunnel is disconnected. Is it possible to use static route or can only use BGP?

Answer 1

Hello @Lê Vũ Thùy Dương

Every Azure VPN gateway consists of two instances in an active-standby configuration. For any planned maintenance or unplanned disruption that happens to the active instance, the standby instance would take over (failover) automatically, and resume the S2S VPN connection.

To provide better availability for your cross premises connections you can create an Azure VPN gateway in an active-active configuration, where both instances of the gateway VMs will establish S2S VPN tunnels to your on-premises VPN device, as shown the following diagram:
In this configuration, each Azure gateway instance will have a unique public IP address, and each will establish an IPsec/IKE S2S VPN tunnel to your on-premises VPN device specified in your local network gateway and connection.

Azure VPN Gateway support multiple tunnels between a VNet and an on-premises site with automatic failover based on BGP
This capability provides multiple tunnels (paths) between the two networks in an active-active configuration.

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-bgp-overview